automation • incident response • identity security • cloud • detection engineering • CTI • threat research- Identity & Access Management (IAM)
- Detection Engineering & Adversary Simulation
- Threat Hunting & Behavioral Analytics
- Cloud Security (AWS / Azure / GCP)
- Infrastructure & Security Automation
- Cyber Threat Intelligence (CTI)
- Research-Driven Security Operations
- Incident Response
- Building detection logic for identity-centric attack paths
- Researching cloud and SaaS persistence techniques
- Developing automation for IR and enrichment workflows
- Mapping attacker tradecraft to IAM telemetry
- Threat hunting across hybrid identity environments
- Experimenting with detection-as-code pipelines
- Entra ID / Azure AD
- Okta
- Active Directory
- SSO / Federation
- Conditional Access
- Privileged Identity Management
- OAuth / OIDC / SAML
- Sigma
- KQL
- SPL
- YARA
- MITRE ATT&CK
- Detection-as-Code
- Threat Modeling
- AWS
- Azure
- GCP
- Terraform
- Docker
- Kubernetes
- CI/CD Security
- Incident Response
- Threat Hunting
- DFIR
- Log Engineering
- Telemetry Analysis
- SOAR Automation
- CTI Enrichment
- Identity-based persistence
- Cloud-native attack paths
- SaaS abuse techniques
- Adversary emulation
- Detection validation
- Authentication telemetry analysis
- ATT&CK-informed analytics
- Human + AI security workflows
Detection engineering, automation tooling, cloud security research, identity-focused analytics, and operational security workflows.
Security engineering should reduce uncertainty, not increase complexity.
Research should produce operational outcomes:
- better detections
- faster investigations
- cleaner telemetry
- stronger identity controls
- repeatable automation
- LinkedIn: brianna-morgan-wandt